The legal framework
The Privacy Act 1988 and the thirteen Australian Privacy Principles govern the handling of personal information by federal agencies and by businesses above the turnover threshold. The 2024 reform introduced a statutory tort of serious invasion of privacy, which commenced in 2025 and gives individuals a direct cause of action for intrusion into seclusion or misuse of information.
Key points
| Statute | Privacy Act 1988 and the thirteen Australian Privacy Principles |
|---|---|
| Small business | Many small businesses are still exempt, a long-criticised gap |
| Regulator | Office of the Australian Information Commissioner, free to complain to |
| Statutory tort | Serious invasion of privacy, available since 2025, damages without proof of financial loss |
| Data breaches | Notifiable Data Breaches scheme: notify the regulator and affected individuals |
| Online abuse | eSafety Commissioner can order removal |
| Two limbs | The new tort covers intrusion into seclusion and misuse of private information |
| Serious invasion | The invasion must be serious and intentional or reckless; negligence is not enough |
| Public interest | Balanced against the privacy interest as part of the cause of action |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Document the seriousness of the impact: the threshold is a key element, not an afterthought.
Cost and coverage
The statutory tort of serious invasion of privacy, introduced by the 2024 reform, is the biggest change to Australian privacy law in decades: for the first time an individual can sue directly.
Where to go
- Office of the Australian Information Commissioner.
- eSafety Commissioner for online abuse.
- State or territory legal aid.
Worth knowing
Complain to the organisation first: the Commissioner will normally not take a complaint until the organisation has had thirty days to respond. The statutory tort requires intent or recklessness. Accidental disclosure, however damaging, falls outside it and must be pursued under the Privacy Act.
Official sources and links
- Federal Register of Legislation — Commonwealth law as made and in force
- Services Australia — government services and payments